Trojan.DownLoader23.32944

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%ProgramFiles%\USB Vibration\7906\setup\setup.exe'

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iusD.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscC.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoB.tmp
%TEMP%\isp5.tmp\temp.000
%TEMP%\_se8.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotA.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKe9.tmp
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\isrtfeae.rra
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\Strife6f.rra
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\_IsRff69.rra
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\defaff2b.rra
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\corefe31.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\setufdc4.rra
%TEMP%\f98d.rra
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000
%ProgramFiles%\USB Vibration\7906\setup\setup.exe
%ProgramFiles%\USB Vibration\7906\setup\setup.boot
%ProgramFiles%\USB Vibration\7906\setup\setup.inx
%ProgramFiles%\USB Vibration\7906\setup\setup.ini
%ProgramFiles%\USB Vibration\7906\setup\layout.bin
%ProgramFiles%\USB Vibration\7906\setup\data1.hdr
%ProgramFiles%\USB Vibration\7906\setup\data1.cab
%ProgramFiles%\USB Vibration\7906\setup\engine32.cab
%ProgramFiles%\USB Vibration\7906\setup\data2.cab
%TEMP%\_isdelet.ini
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\temp.000
%TEMP%\igd7.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\025abbf97cd6ce2282d5b0aa9744ecaa_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\set4.tmp
%TEMP%\isp1.tmp\temp.000
%TEMP%\set2.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7d188d398a9886e739caefac250792d9_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\CREDHIST

Удаляет следующие файлы:

%TEMP%\igd7.tmp
%TEMP%\_se8.tmp
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
%TEMP%\set2.tmp
%TEMP%\set4.tmp
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7d188d398a9886e739caefac250792d9_23ef5514-3059-436f-a4a7-4cefaab20eb1

Перемещает следующие файлы:

%CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\setufdc4.rra в %TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\setup.inx
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iusD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\corefe31.rra в %TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\corecomp.ini
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\defaff2b.rra в %TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\default.pal
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\_IsRff69.rra в %TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\_IsRes.dll
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\Strife6f.rra в %TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\StringTable-0009-English.ips
%TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\isrtfeae.rra в %TEMP%\{E49503CA-A52C-4901-8E4E-BD4951CC3907}\{C0EA1DDF-896F-426A-A8FC-500743EECC36}\isrt.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\Setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\IGdi.dll
%TEMP%\isp1.tmp\temp.000 в %TEMP%\isp1.tmp\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp3.tmp\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll
%TEMP%\isp5.tmp\temp.000 в %TEMP%\isp5.tmp\_Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKe9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll